feat(sdk): add dash-sdk-cxx, a C++ binding of dash-sdk for Dash Core

.github/package-filters/rs-packages-direct.yml

@@ -131,6 +131,9 @@ dash-platform-queries:
 dash-sdk:
   - packages/rs-sdk/**
 
+dash-sdk-cxx:
+  - packages/rs-sdk-cxx/**
+
 rs-sdk-ffi:
   - packages/rs-sdk-ffi/**
 

.github/package-filters/rs-packages-no-workflows.yml

@@ -153,6 +153,10 @@ dash-sdk: &sdk
   - *dapi_client
   - *drive
 
+dash-sdk-cxx:
+  - packages/rs-sdk-cxx/**
+  - *sdk
+
 rs-sdk-ffi: &sdk_ffi
   - packages/rs-sdk-ffi/**
   - *simple-signer

.github/package-filters/rs-packages.yml

@@ -181,6 +181,11 @@ dash-sdk: &sdk
   - *dapi_client
   - *drive
 
+dash-sdk-cxx:
+  - .github/workflows/tests*
+  - packages/rs-sdk-cxx/**
+  - *sdk
+
 rs-sdk-ffi: &sdk_ffi
   - .github/workflows/tests*
   - packages/rs-sdk-ffi/**

.github/workflows/tests-rs-workspace.yml

@@ -269,6 +269,30 @@ jobs:
             done
           done
 
+      # Dash Core links dash-sdk-cxx as a static archive whose trust anchors
+      # are its own quorum keys and masternode list: no trusted HTTP
+      # provider, HTTP client or OpenSSL may enter its closure, and it builds
+      # its SDK from the embedder's endpoints only.
+      - name: Check the dash-sdk-cxx trust closure
+        run: |
+          closure=$(cargo tree -p dash-sdk-cxx -e normal --prefix none --locked | awk '{print $1}' | sort -u)
+          for banned in rs-sdk-trusted-context-provider reqwest openssl-sys native-tls; do
+            if grep -qx "$banned" <<<"$closure"; then
+              echo "::error::$banned leaked into dash-sdk-cxx's dependency tree"
+              exit 1
+            fi
+          done
+          if grep -rnE 'new_mainnet|new_testnet|fetch_unproved|dash_network_seeds' \
+              packages/rs-sdk-cxx/src packages/rs-sdk-cxx/include; then
+            echo "::error::dash-sdk-cxx must build its SDK from the embedder's endpoints only"
+            exit 1
+          fi
+
+      # The Rust tests cannot see a broken header layout: link and run the
+      # C++ side from the staged headers and archive alone.
+      - name: Link dash-sdk-cxx from C++
+        run: packages/rs-sdk-cxx/scripts/cxx-smoke.sh
+
       - name: Detect immutable structure changes
         if: github.event_name == 'pull_request'
         run: |
@@ -455,6 +479,7 @@ jobs:
             --package platform-wallet \
             --package platform-wallet-storage \
             --package rs-sdk-ffi \
+            --package dash-sdk-cxx \
             --package platform-wallet-ffi \
             --package rs-dapi-client \
             --package platform-serialization \

Cargo.toml

@@ -40,6 +40,7 @@ members = [
     "packages/app-connect-contract",
     "packages/moderation-charters-contract",
     "packages/rs-sdk-ffi",
+    "packages/rs-sdk-cxx",
     "packages/wasm-drive-verify",
     "packages/dash-platform-balance-checker",
     "packages/rs-dapi",

packages/rs-sdk-cxx/Cargo.toml

@@ -0,0 +1,27 @@
+[package]
+name = "dash-sdk-cxx"
+version.workspace = true
+authors = ["Dash Core Group <dev@dash.org>"]
+edition = "2021"
+rust-version.workspace = true
+license = "MIT"
+description = "C++ binding of dash-sdk for embedders that supply their own quorum keys and signing wallet"
+
+[lib]
+name = "dash_sdk_cxx"
+crate-type = ["staticlib", "rlib"]
+
+[dependencies]
+cxx = "1.0"
+dash-sdk = { path = "../rs-sdk", default-features = false, features = [
+  "dpns-contract",
+  "dashpay-contract",
+  "core_key_wallet",
+] }
+platform-encryption = { path = "../rs-platform-encryption" }
+tokio = { version = "1.40", features = ["rt-multi-thread"] }
+async-trait = "0.1"
+zeroize = "1.8"
+
+[build-dependencies]
+cxx-build = "1.0"

packages/rs-sdk-cxx/build.rs

@@ -0,0 +1,37 @@
+use std::path::Path;
+use std::{env, fs};
+
+/// Generates the cxx bridge and stages the headers an embedder includes
+/// under `target/<profile>/include/`, next to the static archive:
+/// `dash/sdk/ffi.h` (the generated bridge), `dash/sdk/callbacks.h` (the
+/// hand-written C++ callback types the bridge names) and `rust/cxx.h`.
+fn main() {
+    cxx_build::CFG.include_prefix = "dash/sdk";
+    cxx_build::bridge("src/lib.rs")
+        .include("include")
+        .std("c++20")
+        .compile("dash-sdk-cxx-bridge");
+    println!("cargo:rerun-if-changed=src/lib.rs");
+    println!("cargo:rerun-if-changed=include/dash/sdk/callbacks.h");
+
+    let out_dir = env::var("OUT_DIR").expect("OUT_DIR");
+    let include = Path::new(&out_dir)
+        .ancestors()
+        .nth(3)
+        .expect("target/<profile>")
+        .join("include");
+    let generated = Path::new(&out_dir).join("cxxbridge/include");
+    for (from, to) in [
+        (generated.join("dash/sdk/src/lib.rs.h"), "dash/sdk/ffi.h"),
+        (generated.join("rust/cxx.h"), "rust/cxx.h"),
+        (
+            Path::new("include/dash/sdk/callbacks.h").to_path_buf(),
+            "dash/sdk/callbacks.h",
+        ),
+    ] {
+        let to = include.join(to);
+        fs::create_dir_all(to.parent().expect("parent")).expect("create include dir");
+        fs::copy(&from, &to)
+            .unwrap_or_else(|e| panic!("copy {} to {}: {e}", from.display(), to.display()));
+    }
+}